Merge pull request #1201 from bact/add-cooldown

Add cooldown period for dependabot

Author: bact

.github/dependabot.yml

@@ -2,14 +2,21 @@
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+# Read about cooldown periods here:
+# https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
 
 version: 2
 updates:
   - package-ecosystem: "github-actions"
+    cooldown:
+      default-days: 7
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
   - package-ecosystem: "pip"
+    cooldown:
+      default-days: 7
     directory: "/"
     schedule:
       interval: "weekly"