Dependabot: a 7-day cooldown before proposing a new action version #1464

Merged

Joey-Magnus merged 1 commit from sec/dependabot-cooldown into main

2026-11-10 04:00:31 +00:00

Joey-Magnus commented

2026-11-10 03:47:12 +00:00

(Migrated from github.com)

What

.github/dependabot.yml proposed every GitHub Action's newest release once a week, however new it was. A compromised action version (the tj-actions/changed-files pattern) is usually found and pulled within days. With cooldown: default-days: 7, Dependabot proposes a version only once it is a week old, so a bad release has usually been caught before it can reach the pinned workflows. The weekly schedule, grouping and commit pinning are unchanged.

This came from a Syntak Code Security scan of main (rule dependabot-missing-cooldown). It was the only finding in that scan that needed a change; the triage of the other 38 is in the Discord #dev-stuff channel.

Tested

The YAML parses to the expected structure (updates[0].cooldown.default-days = 7). cooldown is a documented Dependabot option for the github-actions ecosystem.

🤖 Generated with Claude Code

## What `.github/dependabot.yml` proposed every GitHub Action's newest release once a week, however new it was. A compromised action version (the tj-actions/changed-files pattern) is usually found and pulled within days. With `cooldown: default-days: 7`, Dependabot proposes a version only once it is a week old, so a bad release has usually been caught before it can reach the pinned workflows. The weekly schedule, grouping and commit pinning are unchanged. This came from a Syntak Code Security scan of `main` (rule `dependabot-missing-cooldown`). It was the only finding in that scan that needed a change; the triage of the other 38 is in the Discord #dev-stuff channel. ## Tested The YAML parses to the expected structure (`updates[0].cooldown.default-days = 7`). `cooldown` is a documented Dependabot option for the `github-actions` ecosystem. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Commenting is not possible because the repository is archived.

No reviewers