chore: disable dependabot cooldown for pip updates - #244
Conversation
📝 WalkthroughWalkthroughDependabot’s pip update configuration now sets the default cooldown period to zero days. ChangesDependabot pip cooldown
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Commit-Check ✔️ |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 16-17: Update the cooldown.default-days setting in the Dependabot
configuration to a supported integer from 1 through 90, or exclude the pip
wildcard from the cooldown rules if pip updates must bypass the release-age
delay; keep the remaining update configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d996529c-a245-4939-9934-5f9357d3a8fe
📒 Files selected for processing (1)
.github/dependabot.yml
| cooldown: | ||
| default-days: 0 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
GitHub Dependabot configuration cooldown default-days range exclude wildcard cooldown
💡 Result:
As of July 31, 2026, GitHub Dependabot applies a default 3-day cooldown period to all version updates to allow new releases to stabilize before creating a pull request [1][2]. This default does not apply to security updates, which continue to be created immediately [3][1]. Key details regarding the cooldown configuration include: Default Cooldown Behavior: - The 3-day default is applied automatically to all version updates if no cooldown block is present in your .github/dependabot.yml file [1][4]. - You can override this by explicitly defining a cooldown block [2]. - The cooldown applies specifically to version updates; security updates are never delayed by this mechanism [3][5][6]. Configuration Range and Options: - The number of days for cooldown parameters (such as default-days) must be an integer between 1 and 90 [5][4]. - Supported parameters within the cooldown block include default-days, semver-major-days, semver-minor-days, and semver-patch-days (the latter three apply only to ecosystems supporting SemVer) [3][4]. Wildcard and Exclusion Rules: - The include and exclude options allow you to specify which dependencies the cooldown applies to [3]. - Both include and exclude support wildcards (e.g., pandas*) to match multiple dependencies [3][5]. - Each list supports up to 150 items [3][5]. - The exclude list always takes precedence over the include list [3]. If a dependency appears in both, it will be excluded from the cooldown and updated immediately [3]. Important Considerations: - Cooldown interacts with your schedule.interval: Dependabot checks for updates based on your schedule, but a release only becomes eligible for a pull request once the cooldown period has elapsed [4]. - The exclude list for cooldown is distinct from the general ignore configuration; while ignore can prevent updates entirely or filter by version/type, cooldown specifically delays the timing of the update [3][7].
Citations:
- 1: https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/
- 2: https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/
- 3: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
- 4: https://dev.to/ahab_indieseek/dependabot-cooldown-configure-the-new-3-day-default-20m0
- 5: https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates
- 6: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-version-updates
- 7: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated
🌐 Web query:
GitHub Dependabot configuration reference cool-downtime default-days value
💡 Result:
As of July 31, 2026, the default behavior for Dependabot version updates includes a mandatory cooldown period of 3 days [1][2]. This means that a new dependency version is not considered for a version update until at least 3 days after its release [1][3]. Key details regarding the default-days value and cooldown configuration: * Default Value: If the cooldown block is omitted from your .github/dependabot.yml file, Dependabot automatically applies a 3-day cooldown period [1][2]. * Security Updates: This default cooldown applies exclusively to version updates and does not affect security updates, which continue to be opened immediately to ensure critical fixes are not delayed [1][2][3]. * Customization: You can override the default by adding a cooldown section to your configuration file [2][3]. The default-days parameter accepts integer values between 1 and 90 [3][4]. * Configuration Usage: yaml updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" cooldown: default-days: 5 # Example: overriding the 3-day default * Interaction with SemVer: If you define specific SemVer-based cooldowns (semver-major-days, semver-minor-days, semver-patch-days), those settings will take precedence over the default-days value [1][3]. This default cooldown was introduced by GitHub on July 14, 2026, to provide a safety window for new releases [2][5].
Citations:
- 1: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
- 2: https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/
- 3: https://docs.github.com/en/enterprise-cloud@latest/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates
- 4: Configuration of a minimum package age required before a PR is created dependabot/dependabot-core#3651
- 5: https://dev.to/ahab_indieseek/dependabot-cooldown-configure-the-new-3-day-default-20m0
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
if [ -f .github/dependabot.yml ]; then
echo '--- .github/dependabot.yml relevant section ---'
nl -ba .github/dependabot.yml | sed -n '1,80p'
else
echo '--- .github/dependabot.yml not found ---'
fi
echo '--- Dependabot cooldown config references in repo ---'
rg -n "cooldown|default-days: 0|exclude:\s*$|exclude:\s*$|-\s\"\\*\"" .github || trueRepository: commit-check/commit-check-action
Length of output: 258
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
if [ -f .github/dependabot.yml ]; then
echo '--- .github/dependabot.yml relevant section ---'
awk '{ printf "%6d %s\n", NR, $0 }' .github/dependabot.yml | sed -n '1,80p'
else
echo '--- .github/dependabot.yml not found ---'
fi
echo '--- Dependabot cooldown config references in repo ---'
grep -RInE "cooldown|default-days|exclude:|-\s\"[\\*]|-\s\*" .github || trueRepository: commit-check/commit-check-action
Length of output: 1051
Use a supported cooldown configuration for pip updates.
default-days must be an integer between 1 and 90. Setting 0 makes this update configuration invalid. If pip updates must not wait for the release-age delay, exclude the wildcard instead:
Proposed fix
cooldown:
- default-days: 0
+ exclude:
+ - "*"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| cooldown: | |
| default-days: 0 | |
| cooldown: | |
| exclude: | |
| - "*" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 16 - 17, Update the
cooldown.default-days setting in the Dependabot configuration to a supported
integer from 1 through 90, or exclude the pip wildcard from the cooldown rules
if pip updates must bypass the release-age delay; keep the remaining update
configuration unchanged.
Dependabot applies a default 3-day cooldown to version updates, which delays dependency bump PRs (e.g. commit-check v2.12.2 was published but skipped because it was within the cooldown window).
Set
cooldown.default-days: 0for the pip ecosystem so new releases are considered immediately. See Dependabot docs.Summary by CodeRabbit