From ebda8fdde8fa0ecfc67211c4623a6c4ee81a2dfc Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:39:18 -0700 Subject: [PATCH] chore: set 7-day Dependabot cooldown, exempt slack deps, in examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a cooldown block to every update entry: default-days: 7 gives third-party deps a settle window (supply-chain safety — satisfies zizmor's dependabot-cooldown audit, which flags an implicit <7-day default), while exclude carves out the slack packages so our own releases still bump immediately. These are example projects meant to demonstrate the current Slack SDK, so slack deps shouldn't wait, but third-party bumps benefit from the settle delay. Applied across all example dirs (methods, block-kit, ai/slackbot-mcp-client/*) and the github-actions entry. Verified: zizmor . reports 0 dependabot-cooldown findings. Co-Authored-By: Claude --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8f89d5a..a8e8d55 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,10 +4,16 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 - package-ecosystem: "maven" directory: "block-kit" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "com.slack.api:*" groups: slack: patterns: @@ -16,6 +22,10 @@ updates: directory: "methods" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "com.slack.api:*" groups: slack: patterns: