From b55df4e1b71bb61bfd765b3cf464e108381bd0e4 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Thu, 27 Aug 2026 00:39:17 -0700 Subject: [PATCH] chore: set 7-day Dependabot cooldown, exempt slack deps, in examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a cooldown block to every update entry: default-days: 7 gives third-party deps a settle window (supply-chain safety — satisfies zizmor's dependabot-cooldown audit, which flags an implicit <7-day default), while exclude carves out the slack packages so our own releases still bump immediately. These are example projects meant to demonstrate the current Slack SDK, so slack deps shouldn't wait, but third-party bumps benefit from the settle delay. Applied across all example dirs (methods, block-kit, ai/slackbot-mcp-client/*) and the github-actions entry. Verified: zizmor . reports 0 dependabot-cooldown findings. Co-Authored-By: Claude --- .github/dependabot.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ea3f3cf..c72ebfa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,23 +4,45 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "ai/slackbot-mcp-client/no-auth" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "slack*" - package-ecosystem: "pip" directory: "ai/slackbot-mcp-client/rich-responses/mcp-apps" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "slack*" - package-ecosystem: "pip" directory: "ai/slackbot-mcp-client/slack-identity" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "slack*" - package-ecosystem: "pip" directory: "block-kit" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "slack*" - package-ecosystem: "pip" directory: "methods" schedule: interval: "daily" + cooldown: + default-days: 7 + exclude: + - "slack*"