Skip to content

Change Gradle Dependabot interval to weekly - #2868

Merged
TheLastProject merged 4 commits into
CatimaLoyalty:mainfrom
methum-m:dependency-cooldown
Dec 12, 2025
Merged

Change Gradle Dependabot interval to weekly#2868
TheLastProject merged 4 commits into
CatimaLoyalty:mainfrom
methum-m:dependency-cooldown

Conversation

@methum-m

@methum-m methum-m commented Dec 10, 2025

Copy link
Copy Markdown
Contributor

This PR adds a 7-day dependency cooldown to the Gradle package ecosystem in Dependabot.

  • Prevents Dependabot from opening PRs for library updates until the version is at least 7 days old.
  • GitHub Actions updates remain weekly; cooldown is only applied to Gradle dependencies.

Original issue: #2853

@TheLastProject

Copy link
Copy Markdown
Member

Sorry, I wasn't really clear enough. I meant a dependency cooldown in the sense of: not downloading a dependency update unless the dependency version itself is at least a week old: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

@methum-m

Copy link
Copy Markdown
Contributor Author

Hey, thanks for clarifying! I’ve updated the PR to add the 7-day cooldown under Gradle. GitHub Actions stays weekly. Should now cover the supply-chain concern. If there’s anything else I should adjust, please let me know!

@TheLastProject

Copy link
Copy Markdown
Member

Could we add the cooldown to GitHub Actions too? Malicous updates are possible there too.

Otherwise this looks good, thanks :)

@methum-m

Copy link
Copy Markdown
Contributor Author

Thanks for your patience! I’ve updated the PR to add the 7-day cooldown to GitHub Actions as well !

@TheLastProject TheLastProject linked an issue Dec 12, 2025 that may be closed by this pull request
@TheLastProject
TheLastProject merged commit efbc930 into CatimaLoyalty:main Dec 12, 2025
3 checks passed
@TheLastProject

Copy link
Copy Markdown
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement dependency cooldowns

2 participants