Skip to content

Commit e0c9637

Browse files
authored
tools: exclude @node-core/doc-kit from dependabot cooldown
`@node-core/doc-kit` is an internal package maintained within the nodejs organization, which is unlikely to be a direct source of supply-chain attack. The cooldown only slow down the propagation of new improvements from doc-kit to Node.js repo and causes surprises. The cooldown should be configured in the `doc-kit` repository instead. Currently there is a 3-day cooldown. Maybe we need to increase that to match the 5-day cooldown used in this repository. This patch excludes `@node-core/doc-kit` from the cooldown. Note that `@node-core/doc-kit` is the only dependency in `tools/doc`. But to be future proof, I did't remove the cooldown directly. PR-URL: nodejs#62775 Reviewed-By: Claudio Wunder <cwunder@gnome.org> Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 7560670 commit e0c9637

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

.github/dependabot.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ updates:
5252
semver-major-days: 5
5353
semver-minor-days: 5
5454
semver-patch-days: 5
55+
exclude:
56+
- '@node-core/doc-kit'
5557
commit-message:
5658
prefix: tools
5759
open-pull-requests-limit: 10

0 commit comments

Comments
 (0)