Skip to content

chore: disable dependabot cooldown for pip updates #244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shenxianpeng merged 1 commit into from
Jul 31, 2026
Merged

chore: disable dependabot cooldown for pip updates #244

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,5 @@ updates:
directory: /
schedule:
interval: "daily"
cooldown:
default-days: 0
Comment on lines +16 to +17

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

GitHub Dependabot configuration cooldown default-days range exclude wildcard cooldown

💡 Result:

As of July 31, 2026, GitHub Dependabot applies a default 3-day cooldown period to all version updates to allow new releases to stabilize before creating a pull request [1][2]. This default does not apply to security updates, which continue to be created immediately [3][1]. Key details regarding the cooldown configuration include: Default Cooldown Behavior: - The 3-day default is applied automatically to all version updates if no cooldown block is present in your .github/dependabot.yml file [1][4]. - You can override this by explicitly defining a cooldown block [2]. - The cooldown applies specifically to version updates; security updates are never delayed by this mechanism [3][5][6]. Configuration Range and Options: - The number of days for cooldown parameters (such as default-days) must be an integer between 1 and 90 [5][4]. - Supported parameters within the cooldown block include default-days, semver-major-days, semver-minor-days, and semver-patch-days (the latter three apply only to ecosystems supporting SemVer) [3][4]. Wildcard and Exclusion Rules: - The include and exclude options allow you to specify which dependencies the cooldown applies to [3]. - Both include and exclude support wildcards (e.g., pandas*) to match multiple dependencies [3][5]. - Each list supports up to 150 items [3][5]. - The exclude list always takes precedence over the include list [3]. If a dependency appears in both, it will be excluded from the cooldown and updated immediately [3]. Important Considerations: - Cooldown interacts with your schedule.interval: Dependabot checks for updates based on your schedule, but a release only becomes eligible for a pull request once the cooldown period has elapsed [4]. - The exclude list for cooldown is distinct from the general ignore configuration; while ignore can prevent updates entirely or filter by version/type, cooldown specifically delays the timing of the update [3][7].

Citations:

🌐 Web query:

GitHub Dependabot configuration reference cool-downtime default-days value

💡 Result:

As of July 31, 2026, the default behavior for Dependabot version updates includes a mandatory cooldown period of 3 days [1][2]. This means that a new dependency version is not considered for a version update until at least 3 days after its release [1][3]. Key details regarding the default-days value and cooldown configuration: * Default Value: If the cooldown block is omitted from your .github/dependabot.yml file, Dependabot automatically applies a 3-day cooldown period [1][2]. * Security Updates: This default cooldown applies exclusively to version updates and does not affect security updates, which continue to be opened immediately to ensure critical fixes are not delayed [1][2][3]. * Customization: You can override the default by adding a cooldown section to your configuration file [2][3]. The default-days parameter accepts integer values between 1 and 90 [3][4]. * Configuration Usage: yaml updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" cooldown: default-days: 5 # Example: overriding the 3-day default * Interaction with SemVer: If you define specific SemVer-based cooldowns (semver-major-days, semver-minor-days, semver-patch-days), those settings will take precedence over the default-days value [1][3]. This default cooldown was introduced by GitHub on July 14, 2026, to provide a safety window for new releases [2][5].

Citations:

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

if [ -f .github/dependabot.yml ]; then
  echo '--- .github/dependabot.yml relevant section ---'
  nl -ba .github/dependabot.yml | sed -n '1,80p'
else
  echo '--- .github/dependabot.yml not found ---'
fi

echo '--- Dependabot cooldown config references in repo ---'
rg -n "cooldown|default-days: 0|exclude:\s*$|exclude:\s*$|-\s\"\\*\"" .github || true

Repository: commit-check/commit-check-action

Length of output: 258

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

if [ -f .github/dependabot.yml ]; then
  echo '--- .github/dependabot.yml relevant section ---'
  awk '{ printf "%6d  %s\n", NR, $0 }' .github/dependabot.yml | sed -n '1,80p'
else
  echo '--- .github/dependabot.yml not found ---'
fi

echo '--- Dependabot cooldown config references in repo ---'
grep -RInE "cooldown|default-days|exclude:|-\s\"[\\*]|-\s\*" .github || true

Repository: commit-check/commit-check-action

Length of output: 1051

Use a supported cooldown configuration for pip updates.

default-days must be an integer between 1 and 90. Setting 0 makes this update configuration invalid. If pip updates must not wait for the release-age delay, exclude the wildcard instead:

Proposed fix 
     cooldown:
-      default-days: 0
+      exclude:
+        - "*"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
cooldown:
default-days: 0
cooldown:
exclude:
- "*"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 16 - 17, Update the
cooldown.default-days setting in the Dependabot configuration to a supported
integer from 1 through 90, or exclude the pip wildcard from the cooldown rules
if pip updates must bypass the release-age delay; keep the remaining update
configuration unchanged.