Skip to content

Revert dependabot cooldown configuration #607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kevinjqliu wants to merge 2 commits into from
Closed

Revert dependabot cooldown configuration #607

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f4c2c85
Fix dependabot cooldown config: use default-days and increase to 7
kevinjqliu Mar 27, 2026
b7a532a
partial revert #560
kevinjqliu Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,4 +36,4 @@ updates:
versions: ">=2.16"
open-pull-requests-limit: 50
cooldown:
default: 4
default-days: 7
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ This will:

#### Dependabot Cooldown Period

This repository uses a [Dependabot cooldown period](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown) of 4 days. After a Dependabot PR is merged or closed, Dependabot will wait 4 days before opening the next PR for the same ecosystem. This helps keep the volume of update PRs manageable and gives reviewers time to catch up.
This repository uses a [Dependabot cooldown period](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown) of 7 days. After a Dependabot PR is merged or closed, Dependabot will wait 7 days before opening the next PR for the same ecosystem. This helps keep the volume of update PRs manageable and gives reviewers time to catch up.

> [!TIP]
> We recommend that ASF projects configure a similar cooldown in their own `dependabot.yml` to avoid being overwhelmed by update PRs and to catch up with approved actions here:
Copy link
Copy Markdown
Contributor Author

@kevinjqliu kevinjqliu Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should add this recommendation somewhere

Expand All @@ -157,9 +157,9 @@ This repository uses a [Dependabot cooldown period](https://docs.github.com/en/c
> schedule:
> interval: "weekly"
> cooldown:
> default: 4
> default-days: 7
> ```
> Adjust the `default` value (in days) to match your project's review capacity.
> Adjust the `default-days` value to match your project's review capacity.

### Manual Addition of Specific Versions

Expand Down
Loading