From ca42d6bbd009bf390cf92062130232119efba694 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Thu, 24 Sep 2026 22:13:29 +0900
Subject: [PATCH] chore(deps): add a 7-day cooldown to dependency updates

Dependabot waits 7 days before proposing a new release, so a compromised release has time to be caught. Resolves the Semgrep dependabot cooldown findings.
---
 dependabot.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dependabot.yaml b/dependabot.yaml
index ec85b2e..cb47eb7 100644
--- a/dependabot.yaml
+++ b/dependabot.yaml
@@ -5,8 +5,12 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7