From 022a4050eea5fefa9c8858975cc32ce280942b17 Mon Sep 17 00:00:00 2001
From: Stefan Fleckenstein <stefan@fleckenstein.co.uk>
Date: Fri, 2 Oct 2026 06:34:48 +0100
Subject: [PATCH] chore: cooldown period for dependencies

---
 .github/dependabot.yml | 4 ++++
 .npmrc                 | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a098047..1e1fcb12 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,10 @@ updates:
     schedule:
       interval: weekly
       timezone: Europe/Berlin
+    # Only propose versions released at least 7 days ago. Per GitHub docs this
+    # applies to version updates only; security updates are not delayed.
+    cooldown:
+      default-days: 7
     # Security updates only.
     open-pull-requests-limit: 0
     labels:
diff --git a/.npmrc b/.npmrc
index b6f27f13..950353a3 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,4 @@
 engine-strict=true
+# Only resolve package versions published at least 7 days ago (supply-chain cooldown).
+# Exempt a package with min-release-age-exclude if an urgent fix is needed.
+min-release-age=7