chore: cooldown period for dependencies (#343)

Author: StefanFl

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     schedule:
       interval: weekly
       timezone: Europe/Berlin
+    # Only propose versions released at least 7 days ago. Per GitHub docs this
+    # applies to version updates only; security updates are not delayed.
+    cooldown:
+      default-days: 7
     # Security updates only.
     open-pull-requests-limit: 0
     labels:

.npmrc

@@ -1 +1,4 @@
 engine-strict=true
+# Only resolve package versions published at least 7 days ago (supply-chain cooldown).
+# Exempt a package with min-release-age-exclude if an urgent fix is needed.
+min-release-age=7