Add a cooldown period to dependabot by gpshead · Pull Request #141866 · python/cpython
Conversation
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We already have a monthly interval, so E[dependency updated] is a fortnight. As such I think 14 days might be overkill?
A
[security] Add a cooldown period to dependabot
Add a cooldown period to dependabot
The monthly schedule is not a cooldown. A security cooldown means not auto-updating to a dep until that long after it's release.
fixed up. i'm leaving it as 14d because with our existing monthly schedule we're already not trying to get new versions fast anyways. whenever there is an actual urgent need we'll already be making our own PR, so i'm opting to move slower by default.
StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request
This was referenced