.github/dependabot.yml has no cooldown block on its package-ecosystem entries. A semgrep hook (package_managers.dependabot.dependabot-missing-cooldown, medium severity) flagged this same pattern when copied as a template for attested-delivery/go-htmx's dependabot.yml.
Newly published package versions can be malicious or unstable; without a cooldown, Dependabot proposes updates to versions immediately upon publish.
Fix: add a cooldown block (e.g. default-days: 7) to each package-ecosystem entry. Reference: attested-delivery/go-htmx/.github/dependabot.yml (commit a6b10b2).
Severity: Medium — matches the semgrep-assigned severity; supply-chain hygiene.
.github/dependabot.ymlhas nocooldownblock on its package-ecosystem entries. A semgrep hook (package_managers.dependabot.dependabot-missing-cooldown, medium severity) flagged this same pattern when copied as a template forattested-delivery/go-htmx'sdependabot.yml.Newly published package versions can be malicious or unstable; without a cooldown, Dependabot proposes updates to versions immediately upon publish.
Fix: add a
cooldownblock (e.g.default-days: 7) to eachpackage-ecosystementry. Reference:attested-delivery/go-htmx/.github/dependabot.yml(commita6b10b2).Severity: Medium — matches the semgrep-assigned severity; supply-chain hygiene.