From 8d7324641abceb033ccf44a1584037c2e147086f Mon Sep 17 00:00:00 2001 From: flint Date: Wed, 26 Aug 2026 08:14:24 -0700 Subject: [PATCH] fix(deps): give dependabot a 7-day cooldown matching the install guard Dependabot's bun updater runs `bun install` inside the repo, so it reads bunfig.toml's minimumReleaseAge=604800. Without a matching cooldown it proposes versions younger than that window and the job hard-fails with dependency_file_not_resolvable, turning the Dependabot lane red on main. Dependabot's own default is 3 days, which is why the mismatch bites. Units here are days; bunfig is seconds. Excludes mirror bunfig's. Closes #98 --- .github/dependabot.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 22d85cc..0a10f16 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,6 +16,23 @@ updates: interval: weekly day: monday open-pull-requests-limit: 5 + # PAIRED WITH bunfig.toml `minimumReleaseAge = 604800` (7 days). Keep them + # equal. Dependabot's updater runs `bun install` INSIDE this repo, so it + # reads that gate; without a matching cooldown it proposes versions younger + # than the window and the job HARD-FAILS with + # `dependency_file_not_resolvable`, turning the Dependabot lane red on main + # (bob#98). Dependabot's own default is only 3 days, which is why the + # mismatch bites. + # + # Units here are DAYS (1-90); bunfig is SECONDS. 7 days == 604800 s. + # The excludes MIRROR bunfig's `minimumReleaseAgeExcludes` — a package our + # install guard accepts immediately should not be held back by dependabot. + # If you change one list, change the other. + cooldown: + default-days: 7 + exclude: + - "@types/node" + - "typescript" groups: typescript-ecosystem: patterns: