🏗️✨：hold dependabot to a week before proposing - #1805
Merged
Conversation
What the semgrep audit rule asks for. A newly published version is where a compromised release lands, and a week is long enough for one to be noticed and pulled. Security updates are not held back by cooldown. Assisted-by: Claude-Code:claude-opus-5
`config:best-practices` brings in `security:minimumReleaseAgeNpm`, which waits three days and matches only the npm datasource -- so the pinned action digests and the URL-pinned dprint plugins had no wait at all. A preset's package rules are merged ahead of the repository's own and the last matching rule wins, so this has to be expressed as a rule rather than as the top-level setting. The second rule puts back what the preset sets and the first would otherwise undo. Assisted-by: Claude-Code:claude-opus-5
Renovate can only wait on the versions it proposes. The transitive versions a lockfile refresh pulls in are resolved by pnpm, and its own `lockFileMaintenance` rule waives the wait there because it cannot validate them -- so without this, the weekly refresh was a way in for a package published hours earlier. pnpm re-checks every lockfile entry, not just newly resolved ones, so the lockfile had to be rebuilt from a fresh resolution to satisfy the policy. Eleven transitives moved back on their own; cssnano, postcss and vnu-jar are pinned exactly and needed the pin lowered to the newest version old enough to install. Renovate will raise them again once they have aged, which is the policy working rather than churn. Assisted-by: Claude-Code:claude-opus-5
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This was referenced Aug 12, 2026
DerekNonGeneric
force-pushed
the
chore/dependency-cooldowns
branch
2 times, most recently
from
August 13, 2026 02:35
5b38f8f to
b51d7fd
Compare
DerekNonGeneric
changed the title
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the semgrep audit finding
dependabot-missing-cooldown, and sets the equivalent wait in the two other places that decide what version gets installed.A newly published version is where a compromised release arrives. A week is long enough for one to be noticed and pulled, and short enough not to matter for anything else here.
Three layers, because each covers what the others cannot
.github/dependabot.ymlcooldown.default-days.renovaterc.json5minimumReleaseAgepnpm-workspace.yamlminimumReleaseAgeRenovate was already partly covered, which surprised me.
config:best-practicespulls insecurity:minimumReleaseAgeNpm— three days, and scoped tomatchDatasources: ["npm"]. The pinned GitHub Action digests and the URL-pinned dprint plugins the custom managers watch had no wait at all.Raising it had to be done as a package rule, not the top-level setting: a preset's
packageRulesare merged ahead of the repository's own, and the last matching rule wins, so a top-level value would have lost to the preset's 3 days for exactly the packages that matter most. A second rule puts back the preset'slockFileMaintenance: minimumReleaseAge: null, which the catch-all would otherwise undo.pnpm is the layer that closes the gap that rule leaves open. Renovate waives the wait for lock file maintenance because it cannot validate transitive versions there — so the weekly refresh was a route in for a package published hours earlier. pnpm resolves those, and now applies the same week to them.
Security fixes are not delayed at any layer: Dependabot cooldown does not apply to security updates, Renovate's
vulnerabilityAlertsdefault carriesminimumReleaseAge: null, and pnpm waives it foraudit --fixadvisories.Why the lockfile is in this PR
pnpm re-verifies every lockfile entry on install, not only newly resolved ones. Turning the setting on made
pnpm installfail outright:Those 16 came in with the Aug 9 lock file maintenance. Rebuilding from a fresh resolution moved 11 back on their own. Five were held by exact pins, so three had to be lowered to the newest version old enough to install:
cssnanopostcssvnu-jarRenovate will raise all three again once they have aged, in one grouped PR. That is the policy working rather than churn — and it is what makes this self-sustaining: from now on every lockfile refresh resolves under the wait, so the lockfile stays compliant instead of needing this again.
Setting
minimumReleaseAgealso turns onminimumReleaseAgeStrictimplicitly, which is what we want — an immature pick fails the install rather than quietly adding itself tominimumReleaseAgeExclude.Considered and rejected:
trustLockfile: truewould have landed this without any downgrade, by skipping verification of entries already in the lockfile. It also permanently disables the check that catches a lockfile produced with the policy bypassed, which is most of the point.Verification
pnpm install --frozen-lockfile— passes, which it did not before the rebuildnps test— 13/13nps build— 26 copied, 34 writtenmain.min.cssat 132,800 bytesNote
Unrelated, but visible from here: Dependabot and Renovate are both configured for npm in this repository, and Dependabot has opened 560 PRs — the most recent, #1700, is still open from October. Worth deciding whether it should stay on npm or be narrowed, but not in this PR.